True that. But the intention of building Bahmni is different. It's primary focus was to get the EMR for resource constrained (in terms of money, computer skilled people).

I was part of the team which build it for about an year and can definitely say it did change the medical eco-system in such places

They are adamant that it's a "HOSPITAL SYSTEM FOR LOW RESOURCE SETTINGS".

I'm familiar with another big medical software provider, and it's a cludgy mess, but it's all about the RFP and how the software can help in billing and meeting Meaning(ful|less) Use targets.

Same thing in germany: you won't get a hospital to use this, ever. Selling to hospitals is enterprise sales ^10 - we see sales cycles between 3 to 8 years (that is from initial lead to project delivery).

It might have a chance in developing countries with less regulation in place.

Google Deepmind is doing some great work with NHS in the UK, both on deep learning of medical images, but also on electronic health records (and mobile apps for doctors). What I've seen so far literally obliterates Epic user interface (which is not a high bar). But I'm not sure Google will open source the work, I think they will turn it into a profit stream. Still a win for doctors and taxpayers, less doctor time wasted fighting ancient software.

People are trying to change that. http://letdoctorsbedoctors.com/ - the "EMR State of Mind" parody is pretty fun

I've been working on something to help with data security. If your software project runs into PCI, HIPAA or other data security/compliance issues, we have a solution that can offload the risk and compliance work from your system without any code changes on your end. We have several customers using it in production and are profitable. If you're interested, my email is in my HN profile. I'd love to chat.

I am curious why so much needs to be done for HIPPA compliance anytime something is held in electronic form.

What if you have a computer, unconnected to the internet, simply sitting in a doctors office with billing information on it.... does this system need more 'protection' and regulation than the one it replaced of paper files, and sticky notes?

There are many layers of HIPAA outside of of just electronic data security. You must train your staff on security protocols (e.g not sniffing for celebrity records, etc).

I am pretty sure even if your office is all paper charts you still fall under certain HIPAA guidelines such as notifying patients if there was a breach (e.g physically stealing records from the office). This happened in Rocklin, CA a few years ago.

http://www.cda.org/news-events/burglary-leads-to-lengthy-hip...

Yes. Thats the role of regulation, to entrench the incumbent and stifle acceptable innovation.

Plus add to what you mentioned that you need strong disk encryption and some physical security. Else an external key logger and its over.

PCI compliance isn't relevant unless the software is processing card payments for patients.

Bundle it with Watsi and support it for the third world. That's how you bootstrap it.